krb5kdc is crashing intermittently on the IPA server even after updating the packages to latest version.

This crash is due to the is_master_host() function[1], which is called in ipadb_fill_info3()[2] as part of the process to populate the PAC.

is_master_host() searches for a master host entry using ipadb_simple_search()[3], and interprets an error as the absence of master entry, and the absence of error as a the presence of a master entry. Hence, a connection error would be misinterpreted.

The crash occurs because in case ipadb_simple_search() faces a connection issue during the query, it will try to reset the connection to run the query again. But if it fails to reset the connection, it returns with an error code right away, leaving the LDAP context uninitialized. But, as mentioned above, is_master_host() won't handle this as an actual error. So the process in ipadb_fill_info3() will continue until the ldap_get_entry_controls() call, where the process crashes because of the uninitialized LDAP context.

[1] https://github.com/freeipa/freeipa/blob/release-4-9-12/daemons/ipa-kdb/ipa_kdb_mspac.c#L404
[2] https://github.com/freeipa/freeipa/blob/release-4-9-12/daemons/ipa-kdb/ipa_kdb_mspac.c#L695-L697
[3] https://github.com/freeipa/freeipa/blob/release-4-9-12/daemons/ipa-kdb/ipa_kdb_common.c#L169